You can't change anything under /libs. Full stop. Immutability is enforced via a Composite Nodestore [1],/apps is a mounted nodestore/libs is another mounted nodestore that you can think of as a read-only 'golden master' Your repo init scripts can do anything under /appsBut you won't be able to do anything under /libs -- you'll encounter runtime errors during the buildImage step of your pipeline and it will ultimately fail. [1] -- https://jackrabbit.apache.org/oak/docs/nodestore/compositens.html

RE. : Dispatcher version 4.1.0 with apache 2.2. Yikes... why so old?   

You need to capture the SAML Response from your Idp and inspect it to understand why it failed. Just capture the browser network traffic, save that traffic as a HAR file -- thenUse something like Google's HAR analyzer to inspect that traffic -- https://toolbox.googleapps.com/apps/har_analyzer/-- thenFind the POST request to your Idp-- then You need to base64 decode the SAMLResponse using something like : https://www.samltool.com/decode.php The SAMLResponse will tell you everything. AEM isn't doi...

No root cause? Authentication in via CRX DE was removed from the product and documented in the release notes.

You need to edit the Page Template Policies on the Layout Container to allow various Component Groups. See : https://docs.adobe.com/content/help/en/experience-manager-65/developing/platform/templates/page-templates-editable.html#page-policies